# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-71385.md)
  `CVE-2026-71385` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106623.md)
  `CVE-2026-106623` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106617.md)
  `CVE-2026-106617` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [IBM WebSphere Application Server Liberty Improper Access Control](https://agentprime.io/advisories/CVE-2026-93895.md)
  `CVE-2026-93895` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [IBM WebSphere Application Server Liberty Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-95695.md)
  `CVE-2026-95695` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 7.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [IBM WebSphere Application Server Liberty is affected by an improper access control](https://agentprime.io/advisories/CVE-2026-105443.md)
  `CVE-2026-105443` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 8.2 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [IBM WebSphere Application Server Liberty Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-11713.md)
  `CVE-2026-11713` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Insecure Default File Permissions in Okta RADIUS Agent Windows Installer](https://agentprime.io/advisories/CVE-2026-78632.md)
  `CVE-2026-78632` · CVE record: Okta Okta RADIUS Agent · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit](https://agentprime.io/advisories/CVE-2026-63172.md)
  `CVE-2026-63172` · CVE record: Omnispace Agora Project · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList](https://agentprime.io/advisories/CVE-2026-63174.md)
  `CVE-2026-63174` · CVE record: Omnispace Agora Project · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()](https://agentprime.io/advisories/CVE-2026-63153.md)
  `CVE-2026-63153` · CVE record: Omnispace Agora Project · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload](https://agentprime.io/advisories/CVE-2026-63163.md)
  `CVE-2026-63163` · CVE record: Omnispace Agora Project · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Adobe Experience Manager | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-90532.md)
  `CVE-2026-90532` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Adobe Experience Manager | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-75732.md)
  `CVE-2026-75732` · CVE record: Adobe Adobe Experience Manager 6.5 LTS and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Adobe Experience Manager | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-48383.md)
  `CVE-2026-48383` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Adobe Experience Manager | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-48382.md)
  `CVE-2026-48382` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [CVE-2026-16753](https://agentprime.io/advisories/CVE-2026-16753.md)
  `CVE-2026-16753` · CVE record: Lowcoder Lowcoder · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Ente: Accepted emergency contact can bypass the recovery notice period](https://agentprime.io/advisories/CVE-2026-104875.md)
  `CVE-2026-104875` · CVE record: ente ente and 1 more · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation](https://agentprime.io/advisories/CVE-2026-110112.md)
  `CVE-2026-110112` · CVE record: Finsys dockhand · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Server Update Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-105009.md)
  `CVE-2026-105009` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Role: DNS Server Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-103560.md)
  `CVE-2026-103560` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Group Policy Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-100217.md)
  `CVE-2026-100217` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-97792.md)
  `CVE-2026-97792` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Role: DNS Server Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-96926.md)
  `CVE-2026-96926` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows NTFS Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-96918.md)
  `CVE-2026-96918` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70246.md)
  `CVE-2026-70246` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft Office SharePoint Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70217.md)
  `CVE-2026-70217` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 4.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Skype for Business Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85873.md)
  `CVE-2026-85873` · CVE record: Microsoft Skype for Business Server 2015 CU13 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft Exchange Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-77910.md)
  `CVE-2026-77910` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Active Directory Domain Services Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-70229.md)
  `CVE-2026-70229` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WebDAV Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-88135.md)
  `CVE-2026-88135` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Device Install Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83792.md)
  `CVE-2026-83792` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Hyper-V Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-83766.md)
  `CVE-2026-83766` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Clipboard User Service Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83764.md)
  `CVE-2026-83764` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83568.md)
  `CVE-2026-83568` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Key Distribution Center Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-69640.md)
  `CVE-2026-69640` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Modern Device Management (MDM) Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-96855.md)
  `CVE-2026-96855` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Routing and Remote Access Service (RRAS) Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-96316.md)
  `CVE-2026-96316` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Overlay Filter Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-96315.md)
  `CVE-2026-96315` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Network List Service Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-96311.md)
  `CVE-2026-96311` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-88198.md)
  `CVE-2026-88198` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WebDAV Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-87714.md)
  `CVE-2026-87714` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Broadcast DVR User Service Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-85938.md)
  `CVE-2026-85938` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft PowerShell Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-70185.md)
  `CVE-2026-70185` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Encrypting File System (EFS) Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-88162.md)
  `CVE-2026-88162` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows SMB Client Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-84011.md)
  `CVE-2026-84011` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Bind Filter Driver Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70299.md)
  `CVE-2026-70299` · CVE record: Microsoft Windows 11 version 23H2 and 3 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Error Reporting Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83658.md)
  `CVE-2026-83658` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Geotag Broker Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83583.md)
  `CVE-2026-83583` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Hello Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-70280.md)
  `CVE-2026-70280` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows StateRepository API Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70218.md)
  `CVE-2026-70218` · CVE record: Microsoft Windows 11 Version 24H2 and 3 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, CWE-1220
- [Role: DNS Server Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-70087.md)
  `CVE-2026-70087` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Role: DNS Server Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-70083.md)
  `CVE-2026-70083` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Role: DNS Server Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-70085.md)
  `CVE-2026-70085` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Routing and Remote Access Service (RRAS) Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-70057.md)
  `CVE-2026-70057` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Kernel-Mode Drivers Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-69971.md)
  `CVE-2026-69971` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows AppX Deployment Extensions Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69945.md)
  `CVE-2026-69945` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows AppX Deployment Service Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-69905.md)
  `CVE-2026-69905` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Event Tracing Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-70235.md)
  `CVE-2026-70235` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Windows Mobile Broadband Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-97800.md)
  `CVE-2026-97800` · CVE record: Microsoft Windows 11 Version 24H2 and 3 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTEzVDE4OjU5OjMwLjY4NjAwMFoiLCJDVkUtMjAyNi05NzgwMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTEzVDIwOjIxOjI1LjgwODAwMFoiLCJDVkUtMjAyNi0xMDU5MDEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTEzVDIwOjIxOjI1LjgwODAwMFoiLCJDVkUtMjAyNi0xMDU5MDEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.